Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 rpmuncompress 中发现一个缺陷。此命令注入漏洞允许本地攻击者执行任意命令。rpmuncompress 处理包含 shell 元字符的特别构建的存档文件名时发生此情况，这些元字符在传递给 shell 命令字符串之前未被正确转义。成功利用需要用户交互，其中用户或自动化工作流会对恶意文件调用 rpmuncompress，从而对调用用户可访问数据的机密性、完整性和可用性造成重大影响。（CVE-2026-84838）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 rpmuncompress 中發現缺陷。此命令插入弱點允許本機攻擊者執行任意命令。當 rpmuncompress 處理包含 shell 中繼字元的特製封存檔名時，會發生此問題，這些中繼字元在傳遞至 shell 命令字串之前未正確逸出。成功的惡意利用需要使用者互動，其中使用者或自動化工作流程會在惡意檔案上叫用 rpmuncompress，從而對叫用使用者可存取的資料的機密性、完整性和可用性造成重大影響。（CVE-2026-84838）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - rpmuncompress に欠陥が見つかりました。このコマンドインジェクションの脆弱性により、ローカルの攻撃者が任意のコマンドを実行する可能性があります。これは、シェルのメタ文字が含まれた特別に細工されたアーカイブファイル名を rpmuncompress が処理するときに発生します。このファイルは、シェルコマンド文字列に渡される前に適切にエスケープされません。悪用を成功させるにはユーザーインタラクションが必要です。このとき、ユーザーまたは自動化されたワークフローが悪意のあるファイルのrpmuncompressを呼び出し、呼び出し側のユーザーがアクセスできるデータの機密性、整合性、可用性に大きな影響を与えます。(CVE-2026-84838)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute     arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename     containing shell metacharacters, which are not properly escaped before being passed to shell command     strings. Successful exploitation requires user interaction, where a user or automated workflow invokes     rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and     availability of data accessible to the invoking user. (CVE-2026-84838)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Rocky Linux 10.3 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_99595 advisory.

    * rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)

    * rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path (CVE-2026-84837)

    * rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames     (CVE-2026-84233)

    * rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99595 advisory.

    The RPM Package Manager (RPM) is a command-line driven package management system capable of installing,     uninstalling, verifying, querying, and updating software packages.

    Security Fix(es):

    * rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)

    * rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path (CVE-2026-84837)

    * rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames     (CVE-2026-84233)

    * rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:99595 advisory.

    * rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838)

    * rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path (CVE-2026-84837)

    * rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames     (CVE-2026-84233)

    * rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
342505	Linux Distros 未修补的漏洞：CVE-2026-84838	Nessus	Misc.	2026/9/3	2026/11/12	high
342505	Linux Distros 未修補弱點：CVE-2026-84838	Nessus	Misc.	2026/9/3	2026/11/12	high
342505	Linux Distros のパッチ未適用の脆弱性: CVE-2026-84838	Nessus	Misc.	2026/9/3	2026/11/12	high
342505	Linux Distros Unpatched Vulnerability : CVE-2026-84838	Nessus	Misc.	2026/9/3	2026/11/12	high
381285	Rocky Linux 10.3 [CIQ] Security Update: python3-rpm / python3-rpm-debuginfo / rpm / rpm-apidocs / rpm-build / etc Multiple Vulnerabilities (crlsa-2026_99595)	Nessus	Rocky Linux Local Security Checks	2026/11/14	2026/11/14	high
379603	RHEL 10 : rpm (RHSA-2026:99595)	Nessus	Red Hat Local Security Checks	2026/11/12	2026/11/12	high
380257	RockyLinux 10 : rpm (RLSA-2026:99595)	Nessus	Rocky Linux Local Security Checks	2026/11/13	2026/11/13	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high